Capture RTP and SIP Traffic using tcpdump

sip rtp tcpdump
Boardy picture Boardy · Jul 27, 2012 · Viewed 72k times · Source

I need to capture SIP and RTP traffic to find a problem with something. I can capture SIP messages fine but am having a problem with capturing the RTP traffic.

I've tried the following but this is only getting out the SIP packages and no RTP.

tcpdump -T rtp -vvv src -s 1500 -i any -w /home/lantrace_test2.pcap port 5060

The other way I was thinking of doing it is as rtp uses a range of UDP ports, capturing the range that we are using for the RTP traffic but I can't find a way of capturing a range of ports so not sure if tcpdump supports port ranges for capture

Thanks for any help you can provide

Answer

Frank Shearar picture Frank Shearar · Jul 27, 2012

Your SIP traffic runs over 5060, as you know, but the port on which to sniff RTP is described by the SDP bodies of the SIP messages. In other words, there's no way to know on which ports to sniff until the offer/answer exchange has completed.

If you know something about the user agents involved, then you could try tricks like capturing traffic on a range of ports. (Something like tcpdump -n dst portrange 10000-11000 for instance.)

Related questions

Best C++ RTP/RTSP library

I'm looking for a RTP/RTSP library in C++. I found pjsip but it is more C-style. I'm looking for more OO library.

Read More
CSRC and SSRC in RTP

I am very new to RTP , can some one explain about the CSRC and SSRC in general? From http://www.rfc-editor.org/rfc/rfc3550.txt , what it says is : The SSRC field identifies the synchronization source. Does it mean , in …

Read More
Minimum SDP for making a H264 RTP stream?

I'm looking for an example of a minimum necessary SDP for setting up a H264 video stream.| The assumption is that the receiver can play H264 as long as it gets the required parameters through SDP. I have found a …

Read More